Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95275

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95275

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95275

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95275
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5703 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:13:01 GMT
Publisher date: Tue, 29 Sep 2026 17:31:52 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95284

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Chrome CVE-2026-95284

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95284

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95284
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5658 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:12:32 GMT
Publisher date: Tue, 29 Sep 2026 17:31:36 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95327

Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95327

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95327

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95327
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5067 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:02:40 GMT
Publisher date: Tue, 29 Sep 2026 17:31:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2025-6558

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2025-6558

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-6558

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-6558
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4974 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:01:00 GMT
Publisher date: Tue, 15 Jul 2025 18:12:36 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95370

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95370

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95370

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95370
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4937 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:35 GMT
Publisher date: Tue, 29 Sep 2026 17:31:48 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95358

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

Chrome CVE-2026-95358

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95358

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95358
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4936 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:34 GMT
Publisher date: Tue, 29 Sep 2026 17:31:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95344

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)

Chrome CVE-2026-95344

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95344

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95344
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4935 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:33 GMT
Publisher date: Tue, 29 Sep 2026 17:31:54 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95300

Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

Chrome CVE-2026-95300

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95300

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95300
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4934 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:32 GMT
Publisher date: Tue, 29 Sep 2026 17:31:52 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95290

Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95290

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95290

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95290
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4933 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:00:31 GMT
Publisher date: Tue, 29 Sep 2026 17:31:51 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95301

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-95301

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95301

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95301
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4862 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:59:00 GMT
Publisher date: Tue, 29 Sep 2026 17:31:37 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95375

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95375

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95375

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95375
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4853 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:54 GMT
Publisher date: Tue, 29 Sep 2026 17:31:45 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95366

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95366

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95366

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95366
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4852 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:54 GMT
Publisher date: Tue, 29 Sep 2026 17:31:44 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95362

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95362

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95362

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95362
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4851 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:53 GMT
Publisher date: Tue, 29 Sep 2026 17:31:46 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95297

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95297

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95297

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95297
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4850 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:53 GMT
Publisher date: Tue, 29 Sep 2026 17:31:45 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95330

Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95330

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95330

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95330
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4838 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:45 GMT
Publisher date: Tue, 29 Sep 2026 17:31:48 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95376

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

Chrome CVE-2026-95376

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95376

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95376
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4836 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:58:44 GMT
Publisher date: Tue, 29 Sep 2026 17:31:46 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-93379

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-93379

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93379

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93379
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4782 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:57:06 GMT
Publisher date: Thu, 17 Sep 2026 21:08:41 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102310

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-102310

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102310

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102310
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4631 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:55:29 GMT
Publisher date: Tue, 29 Sep 2026 19:45:06 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102320

Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-102320

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102320

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102320
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4630 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:55:29 GMT
Publisher date: Tue, 29 Sep 2026 19:45:06 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102330

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-102330

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102330

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102330
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4629 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:55:28 GMT
Publisher date: Tue, 29 Sep 2026 19:45:07 GMT

Read the original announcement

Older events